Module discovery 

Authorization server metadata: GET /.well-known/oauth-authorization-server. Protected-resource metadata: GET /.well-known/oauth-protected-resource.

atproto’s own discovery chain starts at a DID document, not here: a client resolves an account’s DID, reads its #atproto_pds service entry, and fetches this document from that origin. “Discovery fails before anything else runs if this is wrong” (per this crate’s brief) means the issuer this module reports and the serviceEndpoint that same account’s DID document already carries must be the exact same string — not two independently computed URLs that happen to agree today. issuer_for gets that by construction: it reads the value already published in the zone’s own service document (didbot_pds::Registry::did_document at the zone hostname) rather than reconstructing a hostname from configuration, which is also this module’s answer to “route the issuer through Zone, do not hardcode a hostname.”

Structs

ProtectedResourceMetadata

The protected-resource metadata document, RFC 9728 plus the atproto profile.

ServerMetadata

The authorization server metadata document, RFC 8414 plus the fields the atproto OAuth profile requires.

Enums

DiscoveryError

Why server metadata could not be built for this deployment.

Constants

SCOPES_SUPPORTED 🔒

The scopes both metadata documents advertise, shared so the two cannot drift apart.

Functions

issuer_for

The exact origin a resolver following this deployment’s own DID document would derive — read from the document itself, never recomputed.

protected_resource_metadata

Builds the protected-resource metadata document for this deployment.

request_htu

The absolute htu a DPoP proof must bind to for a request this deployment serves at path — RFC 9449 §4.3’s “a caller-built canonical absolute URL (scheme, host, and path)”, built the same way issuer_for builds issuer: read out of this deployment’s own zone service document rather than the request’s Host header or any X-Forwarded-* header, both of which are ordinary caller-supplied text once didbot-tls is terminating TLS itself with no reverse proxy in front rewriting anything — see crate::rate_limit’s own doc for the same argument applied to a caller’s address. This also gets a development deployment’s plain-http *.localhost origin and a production deployment’s https:// origin right for free, in both directions, because whichever one is true is already baked into the service document an operator configured, not computed here.

server_metadata

Builds the metadata document for this deployment.